Slashdot Log In
Massive Spam Shot of "Storm Trojan"
Posted by
kdawson
on Fri Apr 13, 2007 10:31 AM
from the storm-warning dept.
from the storm-warning dept.
jcatcw writes "Postini has already counted nearly 5 million copies of the spam in the last 24 hours, and calculated that the run currently accounts for 87% of all malware being spread through email. 'Expect this to grow much larger,' a Postini spokesman said; 'It should top out at 60 million messages within the next 24 hours.' It's the largest attack in the last 12 months, and more than three times the volume of the two biggest in recent memory: a pair of blasts in December and January. The spam carries a ZIP file attachment posing as a patch with subjects such as Worm Alert!, Worm Detected, Spyware Detected!, or Virus Activity Detected."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
yep... (Score:2)
Nope (Score:3, Informative)
I have seen a couple of copies of the spam itself, but nothing major.
Re: (Score:3, Interesting)
I hope you are right, because I have had an epiphany and am now one of those who decry the "clueless users/lusers" responsible for letting their machines become infected and recruited into botnets.
I used to have sympathy for them, but as botnets proliferate and my mail servers get pounded even
Re: (Score:3, Insightful)
Re:Nope (Score:5, Interesting)
I have checked the senderbase.org entry and it says like 3500% volume increase over 1 day from that IP!
Still, as old timer I feel uncomfortable posting the IP on web whether it is spammer/worm infected or not. I mean that worm really took off, perhaps the owner of botnet finally accepted the price offered by mob,mafia whatever using it. Yet again, no worries, Clam detects even without opening that password protected zipped junk.
Parent
Another day in the world of near-monoculture. (Score:5, Interesting)
The person to bring this suit would need to be someone who's not a licensee of any MS products, but has suffered losses from their network getting DOS'd by Windows zombies trying to trade copies of the malware of the hour.
-jcr
Re:Another day in the world of near-monoculture. (Score:5, Funny)
Microsoft is to computers what Philip Morris is to lungs.
Woo, a new quote!
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:Another day in the world of near-monoculture. (Score:5, Funny)
Who said it's Windows malware?
(yeah, OK, I was trying to be funny...)
Parent
Re: (Score:3)
If I weren't so tired atm I'd have something deep and witty to say about that, but all I can do is shake my head.
Re:Another day in the world of near-monoculture. (Score:5, Funny)
Parent
Re: (Score:2)
(posted from Linux, by way of a tunneled session from OSX)
Re: (Score:2)
Re: (Score:3, Interesting)
Um, the payload is a .exe file. [symantec.com]
I thought I'd be a smart-ass and show you that it didn't run on Linux. But, damn! I have Wine installed.
Re:Another day in the world of near-monoculture. (Score:5, Insightful)
If anyone should be sued, it should be the ISPs who allow zombies to sit there on their network. I don't like lawsuits, and would prefer to see some government incentive used to compel ISPs to remove the zombies.
Parent
Re: (Score:3, Funny)
The biggest security risk is shared by all operating systems and hardware setups because it's not part of the computer.
It's the lump of carbon, water, and other trace elements/compounds between the keyboard and the chair.
Re: (Score:2)
The poor schmucks with an email who receive the spam are the ones who get it, as well as the poor schmucks who administer an e-mail system that now has to contend with the extra load.
Re: (Score:2, Offtopic)
Too much privilege! (Score:4, Insightful)
Actually, there is a technical flaw, not just a human engineering one. The system allows users to install software, with global system implications, with no confirmation. My Mac confirms such things with me, and seems to get it right. My Linux box won't let me touch the global system configuration at all unless I su to root.
This has always been the problem. I recognize that there is incompetent Windows software out there that won't run without Administrator privileges, but that's another issue. If you really need privilege to do something (like change your password), others systems have ways of temporarily elevating privilege. Like suid on Unix.
...laura
Parent
Re: (Score:3)
That's great, so when you're doing something that you feel really needs to be done, such as protecting your computer from the nasty botnet it is reportedly a part of, or your email will be cut off, you'll click through those prompts to get that patch in. Well maybe not you personally, but you and I are not the common masses.
Vista has the "Cancel or Allow" thingy going now. Do they need to extend it, would that really help?
"Hmm I need to run this patch like the email says,
computer IQ test? (Score:5, Funny)
Are you sure you want to do this?
"YES"
OK what is the end result of this computation 15 XOR 24 ?
" UM 17?"
No, please call your son to ask permission to perform this operation.
Parent
Re: (Score:3, Insightful)
Why the fuck do people keep bashing the UAC? What the fuck is wrong with finally having a real "sudo" in windows? Instead of having to run as administrator all the time, you can now escalate when you want to. Microsoft finally adds better security, and all the whiners come out of the woodwork.
This sort of shit reminds me of my uncle, who thinks he's a computer person:
"I really miss windows 98. It was a simple, no-frills operating system."
"It didn'
Re: (Score:3, Insightful)
One of the problems I had with early revisions of UAC (I haven't had the pleasure of trying out Vista's final version much) is that it couldn't figure out what the user was trying to do and anticipate it. When creating a new file, I first was asked if I was sure I wanted to create it, then I was asked if I was sure that I wanted to rename it. Hey Vista! It's a NEW FILE! I probably
Re: (Score:3, Interesting)
Lets say there was no laws governing seat belts. And theoretically after seat belts where already in wide use among the new.. flying cars that a few people drove. Fly Systems finally invents the flying cars for the average Joe. It really takes off and now almost everyone has a Fly System car, but Fly Systems REFUSES to sell cars with seat belts, despite a market demand. Sure you can
Re: (Score:3, Informative)
Besides, Outlook DOES warn you when you try to launch an executable! I just tried to launch VNC, and it says, "WARNING! This file may contain a virus that can be harmful to your computer. You must save this file to disk before it can be opened. It is important to be VERY certain that this
Re: (Score:3, Insightful)
Re: (Score:2)
I do agree with you that MS should be held responsible for remote exploits and buffer overflows, where the user does nothing and still gets infected. That's a flaw of the system. This (and about 99% of current malware) user user stupidity to infect a system.
Personally, I'd hold a user of a system responsible for what he does with it. If you are stupid enough to click on ever
Re: (Score:2)
What we're talking here is a guy coming up to you, telling you your car is unsafe and that he needs the car keys to drive it around the block to check if it is in danger and to fix it in his garage. Who should be responsible for that, GM or the cluebrick that hands over his keys?
Wow, good thing (Score:5, Funny)
I've Gotten It Several Times... (Score:2)
My officemate got it as the Britney / Paris porn thing twice this week. But she wasn't interested. I got it once. I wasn't interested. I've gotten the "Spyware detected!" with the zip file attached three times: twice at work, and once on my Yahoo! account.
I work at Department of Agriculture, so I'm surprised they didn't install themselves ;-)
I got one, I got one!!! (Score:5, Informative)
Re: (Score:3, Funny)
'Aye, you do indeed,' said Gimli, looking them up and down over the top of his cup. 'Why, your hair is twice as thick and curly as when we parted; and I would swear that you have both grown somewhat, if that is possible for hobbits of your age. This Treebeard at any rate has not starved you.'
I saw one of these yesterday (Score:4, Informative)
We all had a chuckle at how stupid someone would be to actually do that - then we realized grandma probably would, not knowning any better. All the more reason to get grandma off windows and onto at least a Mac, if not Linux.
waaaait just one second... (Score:4, Insightful)
Out of curiosity... since this is a completely social hack, and is just a means to trick somebody into opening up a compressed file and running the included executable... why would a Mac or Linux user be immune? Cannot Mac and Linux users also run executable programs from their desktops? You're confusing the ability to run a program of your choice with the means by which someone is fooling you into thinking you should choose to run it, right?
Parent
Re: (Score:2, Insightful)
Sure, you could write a trojan targeted toward those OSs. And y
Re:waaaait just one second... (Score:5, Insightful)
But it doesn't matter.
The trojan/worm need not be an administrator to trash a user's computer, even with Linux. Let's use Ubuntu as an example. It can still send mail and propagate just fine as a regular user. It can also trash that user's documents and files (which are likely to be the only important data on the machine). It can use a crontab entry to start a daemon on a high-numbered port, which will run without user interaction, or without them even being logged in. That daemon won't be root, but it will still be capable of being a very proficient zombie.
After that, for good measure, it can just run gksudo and simply ask the user for root permission. Ubuntu users are absolutely content to enter their own password into gksudo whenever prompted, especially when performing updates and patches (as this claims to be). So, the trojan will readily then gain root and be free to run completely amock. Trashing or rooting the OS is the obvious next step, but it's probably not even needed after all of the damage and infiltration already accomplished as a regular user.
Seriously - just because it's not Windows does not mean that it's secure. As long as people are able to run arbitrary programs on their own computers, these types of things will continue to be a problem...no matter what kind of computer it is, and no matter if it has root/administrator priveledges or not.
Parent
Re: (Score:3)
Executables are frequently distributed inside compressed archives (eg, ZIP files) in order to prevent email filters from automatically removing them as "dangerous file types." There are ZIP extensions and TAR natively includes UNIX privileges, so there'd be no need to chmod +x malware, as the decompression utility would do it automatically.
To the best of my knowledge, none of these formats will set the setuid bit, though, so from there you'd either need to get the user to run it as root (sudo malware) or,
Re:I saw one of these yesterday (Score:5, Insightful)
Don't think that would happen? You must be dealing with a better class of users than exist in the wild. Of course it would happen, and happen at such a frequency that it would be just another massive exploit.
Windows is targeted because of market penetration. Why bother with less than 5% when you can get 95% in a single effort?
Parent
Just another... (Score:2)
...trap for the unsophisticated Web user. I mean, if you get an email from someone you don't know telling you to update your anti-virus, wouldn't you think that's a little suspicious?
I don't get much spam, because I really don't let my email address float out in the wild, so this kind of thing never bother me. But it just makes me wonder when someone is going to take some initiative and try to build a better system, to minimize the human element as much as possible.
New "Sledgehammer" virus (Score:2)
Please forward this email to everybody you know, then smash your computer with a sledgehammer. NOTE: you must forward the email BEFORE smashing the computer, not after.
###
I swear to God I think people would actually do that. What the hell can the operating system do if people are willing to save a zip file, type in the password, and then run the contents?
Maybe Microsoft should refuse
Re: (Score:2, Insightful)
Re: (Score:2)
Imagine the promise that this tool is gonna remove all WGA troubles for now and ever. Think people would refuse to burn it to CD, log in as admin, give it all rights and permissions, reboot 10 times and hand over every kind of password they have, including those for EBay, Amazon and their bank account?
Simple problem (Score:3, Informative)
One sort of computer doesn't need to be administered any more than your toaster or TV needs to be administered. If the programming cannot be changed by the user in any way and all it does is read email and browse the web. Period. Maybe play some music sometimes. Ideally, such a device has its programming in ROM (not flash) and cannot be changed in any way. No instructions are ever put on R/W memory, ever. Completely and utterly secure the way your toaster is. How many people have found exploits for a toaster?
Windows is perfectly secure when it is properly set up and administered. The problem is that you can't install software on such a computer and you can run all sorts of fun applications. Gee, isn't that too bad. One solution is to require every user to either (a) switch to a appliance that cannot be compromised, (b) pay the ISP to administer their computer or (c) pass a test to be qualified to have a general-purpose computer connected to the Internet. And yes, the test should be similar to the FCC license for HAM radio: long, incredibly detailed and most people can't pass it without lots of work.
The operating system cannot be made secure from users adding software if they are supposed to add software. But users aren't qualified to add software to their computers and if they are allowed to do so, they will add things that will eventually destroy the ability to use the Internet.
Mail server filters (Score:3, Interesting)
A day in the life of a spam filter (Score:3, Interesting)
Trojan is so US centric (Score:5, Funny)
Re: (Score:2)
If it's important to you, I'll check on Monday.
Re: (Score:2)
There is no chance of this not succeeding with people that have no business being responsible for administering a computer.
Re:It scares me to death! (Score:4, Funny)
Sure there is [wikipedia.org]
Parent